# Four States Require Perry Johnson Cybersecurity Reforms

Connecticut, New Jersey, New York, and Michigan reached a settlement with Perry Johnson Companies over a 2023 breach that exposed records belonging to more than 13 million people. The company agreed to pay **$300,000** and implement multifactor authentication, encryption, incident-response standards, and recurring risk assessments; failure to complete the reforms could trigger an additional **$9.7 million** payment. For procurement teams and contractors handling health information, the settlement illustrates the financial and operational consequences of inadequate data safeguards.

- Contractors handling patient or other sensitive health data should evaluate whether their access controls, encryption, incident-response practices, and risk assessments address the specific weaknesses covered by the settlement.
- Procurement professionals can use these safeguards as concrete due-diligence topics when assessing prospective suppliers’ ability to protect sensitive information; the settlement’s requirements apply to Perry Johnson Companies, not automatically to all contractors.
- Companies serving healthcare clients should account for the potential costs of a breach and the need to implement and sustain corrective security measures.

**Jurisdictions:** sled
**Industries:** Healthcare, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 06, 2026

### Government Entities
- Connecticut Attorney General's Office
- New Jersey Attorney General's Office
- New York Attorney General's Office
- Michigan Attorney General's Office

### Vendors
- Perry Johnson Companies ()

### Sources
- [Medical services company settles with 4 states over 2023 hack of sensitive patient records | The Record from Recorded Future News](https://therecord.media/medical-services-company-settles-with-4-state-ags) - The Record from Recorded Future News